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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNJCATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- tf the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- tf NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)S Responsive to communication(s) filed on 20 January 2004 . 
2a)K This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
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4) IE Claim(s) 1,3-22,24-43 and 45-66 is/are pending in the application. 
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5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1.3-22.24-43 and 45-66 is/are rejected. 
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8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 
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Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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DETAILED ACTION 



1. Claims 1-63 were pending. The communication filed 1/20/04 amended Claims 1, 22 and 43 
and cancelled claims 2, 23 and 44. Claims 64-66 were added. Claims 1, 3-22, 24-43 and 45-66 
are pending. 

Response to Arguments 

1 . Applicant's arguments filed 1/20/04 have been fully considered but they are not 
persuasive. 

2. The attorney argues that the centralized framework provides the customized 
implementation to the requesting application and not a result of an operation. 

The attorney is directed to Elgamal et al (6389534B1), column 4, lines 9-24. This says 
that if the cryptographic policy module determines that the cryptographic policy file passes these 
tests, it enables or disables each of the possible forms of encryption that are allowable in that 
market. In Elgamal et al, column 5, lines 25-42, if the called operation is allowed, the service 
module performs the called operation, calling the cryptographic module when necessary. The 
results returned to the application indicate the encryption policies that have been allowed. This 
is the same as what the applicant's invention does (see applicant's specification, page 26, lines 



3. The attorney argues that the application of Elgamal does not request a 
customized implementation of a service. 

The examiner disagrees with attorney on this. Elgamal clearly shows a customized 
implementation of a service. Elgamal talks (on column 3, lines 1-36) about the problem of 



10-11. 
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difficulty of building, testing and localizing different versions of a product. He talks about cost 
and efficient time management being an issue of great concern. He solves this problem by 
creating a modifiable standard product; wherein the features needed by the consumer can be 
turned off or on, depending on the user's needs (see column 4, lines 15-30). Hence a 
customizable implementation of a service is achieved. 

4. The attorney argues that because the framework does not return a customized 
implementation that can be invoked, every time the application wished to request the operation 
or service, it must go through the centralized framework. 

The examiner disagrees with the attorney on this. The applicant in Fig. 2 shows the 
framework as one that receives the request for implementation of a service, determines 
restrictions if any to be imposed, constructs requested implementation and provides the requested 
implementation to the application. Elgamal's Fig. 3 and further elaboration on column 6, lines 
11-31 shows that the application does not have to return to the framework every time it needs to 
request an allowed operation or service. A filtered list is returned to the application (column 6, 
lines 26-29) and hence, the application does not need to go back and call the framework to repeat 
this process whenever it needs to request an operation regarding a cryptographic function within 
the uploaded filtered list. The filtered list of cipher suites are already loaded once to the 
application. Hence the applicant's invention is non-novel and hence unpatentable. 



• 
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5. With regard to Claim 2, the examiner agrees that the citation does not apply. 
Hence Claim 2 rejection has been amended as can be found below in Claim 1 rejection, since 
Claim 2 has been cancelled and appended as part of Claim 1 limitation by the attorney. 



Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before the 
invention by the applicant for patent, except that an international application filed under the 
treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claims 1-16, 22-37 and 43-58 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Elgamal (6389534 Bl). 

With respect to Claim 1, the limitation "receiving a request from the application for a 
customized implementation of a service" is met on column 4, lines 15-23. 

The limitation "determining a set of zero or more restrictions to be imposed upon said 
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customized implementation" is met on column 3, lines 50-58. 

The limitation "dynamically constructing said customized implementation, said 
customized implementation incorporating said restrictions, and comprising enforcement logic for 
enforcing said restrictions; and providing said customized implementation to the application" is 
met on column 3, lines 40-45. 

The limitation "wherein said customized implementation is invocable by the application 
without further interaction with the framework" is met on column 6, lines 23-43. 

With respect to Claim 3, the limitation "wherein the system further comprises a general 
implementation for said service, wherein said general implementation is unrestricted, 
and wherein said customized implementation further incorporates said general 
implementation" is met on column 5, lines 39-42. 

With respect to Claim 4, the limitation "wherein said enforcement logic enforces said 
restrictions on said general implementation" is met on column 5, lines 29-39. 

With respect to Claim 5, the limitation "wherein said enforcement logic is invoked upon 
initialization of said customized implementation" is met on column 5, lines 3-8 and column 4, 
lines 15-23. 

With respect to Claim 6, the limitation "wherein said enforcement logic, when invoked 
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receives a set of desired parameters from the application determines whether the desired 
parameters exceed said restrictions; and in response to a determination that the desired 
parameters exceed said restrictions, preventing said customized implementation from operating" 
is met on column 5, lines 29-39. 

With respect to Claim 7, the limitation "wherein said service is an encryption/decryption 
service, and wherein said enforcement logic, when invoked determines whether a particular 
exemption mechanism has been invoked; and in response to a determination that the particular 
exemption mechanism has not been invoked, preventing said customized implementation from 
operating" is met on column 6, lines 19-29. 

With respect to Claim 8, the limitation "wherein determining the set of zero or more 
restrictions comprises accessing information specifying one or more limitations; and 
processing said limitations to derive said restrictions" is met on column 6, lines 23-31. 

With respect to Claim 9, the limitation "wherein said service is an 
encryption/decryption service, and wherein said information comprises a set of one or 
more default encryption limitations" is met on column 6, lines 16-22. 

With respect to Claim 10, the limitation "wherein said default encryption limitations are 
derived by merging multiple jurisdiction policies and extracting therefrom the most 
restrictive encryption limitation" is met on column 3, lines 55-58. 
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With respect to Claim 1 1, the limitation "wherein determining the set of zero or more 
restrictions comprises accessing information specifying one or more limitations determining 
permissions, if any, granted to the application; and reconciling said limitations and said 
permissions to derive said restrictions" is met on column 6, lines 16-29. 

With respect to Claim 12, the limitation "wherein said limitations and said permissions 
are reconciled to derive restrictions which are least restrictive" is met on column 6, lines 16-29 
and column 9, lines 51-56. 

With respect to Claim 13, the limitation "wherein said service is an 
encryption/decryption service, and wherein said information comprises a set of one or 
more default encryption limitations, and a set of zero or more exempt encryption 
limitations which apply when one or more exemption mechanisms are implemented" is met on 
column 6, lines 23-31. 

With respect to Claim 14, the limitation "wherein said default encryption limitations 
and said exempt encryption limitations are derived by merging multiple jurisdiction 
policies and extracting therefrom the most restrictive encryption limitations" is met on column 3, 
lines 55-58. 
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With respect to Claim 15, the limitation "wherein reconciling said limitations and said 
permissions comprises determining whether the application has been granted any permissions; 
and in response to a determination that the application has not been granted any 
permissions, deriving said restrictions from said set of default encryption limitations" is met on 
column 9, lines 46-51. 

With respect to Claim 16, the limitation "wherein reconciling said limitations and said 
permissions comprises determining whether the application has been granted any permissions 
which require implementation of a particular exemption mechanism; in response to a 
determination that the application has been granted a permission which requires implementation 
of a particular exemption mechanism determining whether said exempt encryption limitations 
allow said particular exemption mechanism to be implemented; and in response to a 
determination that said exempt encryption limitations allow said particular exemption 
mechanism to be implemented, deriving said restrictions from said set of exempt encryption 
limitations" is met on column 7, lines 6-15. 

With respect to Claims 22 and 43, its limitation is similar to Claim 1 limitation and hence 
its rejection can be found above. 

With respect to Claims 24 and 45, its limitation is similar to Claim 3 limitation and hence 
its rejection can be found above. 

With respect to Claims 25 and 46, its limitation is similar to Claim 4 limitation and hence 
its rejection can be found above. 
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With respect to Claims 26 and 47, its limitation is similar to Claim 5 limitation and hence 
its rejection can be found above. 

With respect to Claims 27 and 48, its limitation is similar to Claim 6 limitation and hence 
its rejection can be found above. 

With respect to Claims 28 and 49, its limitation is similar to Claim 7 limitation and hence 
its rejection can be found above. 

With respect to Claims 29 and 50, its limitation is similar to Claim 8 limitation and hence 
its rejection can be found above. 

With respect to Claims 30 and 51, its limitation is similar to Claim 9 limitation and hence 
its rejection can be found above. 

With respect to Claims 3 1 and 52, its limitation is similar to Claim 10 limitation and 
hence its rejection can be found above. 

With respect to Claims 32 and 53, its limitation is similar to Claim 1 1 limitation and 
hence its rejection can be found above. 

With respect to Claims 33 and 54, its limitation is similar to Claim 12 limitation and 
hence its rejection can be found above. 

With respect to Claims 34 and 55, its limitation is similar to Claim 13 limitation and 
hence its rejection can be found above. 

With respect to Claims 35 and 56, its limitation is similar to Claim 14 limitation and 
hence its rejection can be found above. 

With respect to Claims 36 and 57, its limitation is similar to Claim 15 limitation and 
hence its rejection can be found above. 
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With respect to Claims 37 and 58, its limitation is similar to Claim 16 limitation and 
hence its rejection can be found above. 



The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 17-21, 38-42 and 59-63 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Elgamal (6389534 Bl) in view of Schell et al (5933503). 

With respect to Claim 17, Elgamal meets all the limitation except that of a wrapper object 
being implemented and a dynamic implementation being utilized. 

The limitation "wherein the system further comprises a general implementation for said 
service, and wherein dynamically constructing said customized implementation comprises" is 
met by Schell on column 6, lines 36-39. 

The limitation "instantiating the general implementation to give rise to a general 
implementation instance instantiating a wrapper object; and encapsulating said general 
implementation instance and said restrictions within said wrapper object to derive said 
customized implementation" is met by Schell on column 8, lines 6-10. 



Claim Rejections - 35 USC§ 103 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teachings of Schell within the system of Elgamal so as to make the 
system tamper proof. 

With respect to Claim 18, Elgamal meets all the limitation except that of a wrapper object 
being implemented. 

The limitation "wherein said wrapper object comprises one or more invocable methods, 
wherein said general implementation instance comprises one or more invocable methods, and 
wherein encapsulating comprises mapping one or more of the invocable methods of said wrapper 
object to one or more of the invocable methods of said general implementation instance" is met 
by Schell on column 9, lines 32-35 and 46-55. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teachings of Schell within the system of Elgamal so as to make the 
system tamper proof. 

With respect to Claim 19, Elgamal meets all the limitation except that of the wrapper 
object being implemented. 

The limitation "wherein said wrapper object comprises initialization logic for enforcing 
said restrictions on said general implementation instance" is met by Schell on column 9, lines 42- 
45. 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teachings of Schell within the system of Elgamal so as to make the 
system tamper proof. 

With respect to Claim 20, Elgamal meets all the limitation except that of an initialization 
logic being invoked. 

The limitation "wherein said initialization logic is invoked prior to allowing any of the 
invocable methods of said general implementation instance to be invoked" is met by Schell on 
column 9, lines 36-41. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teachings of Schell within the system of Elgamal so as to initialize the 
system. 

With respect to Claim 21, Elgamal meets all the limitation except the limitation described 
in Claim 21. 

The limitation "instantiating an exemption mechanism to give rise to an exemption 
mechanism instance and encapsulating said exemption mechanism instance within said wrapper 
object" is met by Schell on column 8, lines 6-20. 

It would have been obvious to one of ordinary skill in the art to combine the teachings of 
Schell within the system of Elgamal so as to prevent an external attacker from gaining 
knowledge of what is contained within the system. 
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With respect to Claims 38 and 59, its limitation is similar to Claim 17 limitation and 
hence its rejection can be found above. 

With respect to Claims 39 and 60, its limitation is similar to Claim 18 limitation and 
hence its rejection can be found above. 

With respect to Claims 40 and 61, its limitation is similar to Claim 19 limitation and 
hence its rejection can be found above. 

With respect to Claim 41 and 62, its limitation is similar to Claim 20 limitation and hence 
its rejection can be found above. 

With respect to Claim 42 and 63, its limitation is similar to Claim 21 rejection and hence 
its rejection can be found above. 

Claims 64-66 are rejected under 35 U.S.C. 103(a) as being unpatentable over Elgamal (6389534 
Bl) in view of Chan et al (6005942). 

With respect to Claims 64-66, all the limitation is met by Elgamal except the limitation of 
a framework comprising Java Cryptography Extension to Java Platform. This limitation is met 
by Chan et al on column 8, lines 30-44. 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to incorporate the teachings of Chan et al within the system of Elgamal because the 
Java platform provides a uniform programming interface to a 100% Pure Java program 
regardless of the underlying operating system. 



Conclusion 
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Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 . 136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 1 36(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tracey Akpati whose telephone number is 703-305-7820. The 
examiner can normally be reached on 8.30am-6.00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 703-305-4393. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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